Palo Alto Networks confirmed ongoing exploitation of CVE-2026-0257, a flaw in PAN-OS and Prisma Access that can bypass multi-factor authentication and allow unauthorised VPN connections.
The case is a concrete example of how an authentication weakness can expose remote access paths.
A fix was released in May 2026; Qilin and INC have been identified in connection with the attacks.
How attackers act
The Qilin and INC groups have been identified as the perpetrators of these attacks, which affect PAN-OS and Prisma Access systems. Once they gain access, the attackers use specialized tools to explore the company’s network. To move unhindered and avoid detection, they target systems that manage virtual machines, thereby disabling protection programs. They also combine this access with the abuse of other known security vulnerabilities, such as those related to Veeam backup infrastructure.
Who is affected by the threat?
These attacks have targeted various critical sectors, including education, healthcare, financial services, and energy. The severity of the situation led the US CSIA to add the vulnerability to its official list of known confirmed threats on May 13, 2026.
What should companies do?
Palo Alto Networks released a critical patch in May 2026 to address the issue. Companies using affected systems are urged to install the patch immediately. Security managers should also monitor their systems for signs of a potential breach and implement appropriate response protocols.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)